FortiAuthenticator as intermediate LDAP for Corp LDAP

Hi @AEK ,

I hope this Youtube video can help you:

https://www.youtube.com/watch?v=7KrZjqmcIhc&ab_channel=FullProxyLabs

we do that here by having some task in fac that regularly fetches users from AzureAD if they are in a specific AD group. You need the fetch these in order to be able to apply MFA to the user in FAC :)

FAC then acts as radius server for our FGT and IPSEcs and even some AD things. Works fine with AD Auth as 1FA plus FortiToken as 2FA. 

The only negative thing is that some Fortinet Appliances (like e.g. FAZ) do not support radius user groups which requires me to manually create the users there as radius users.

Fortigates and FOS IPSec xauth do support radius groups though.

and AD basically is LDAP too :)

So basically you need to 'proxy' the LDAP through FAC and apply tokens to the users. I did a quick check internally and this is not currently supported in FAC. You can read more about the FortiAuthProxy that seems to support your request.

Thanks for the confirmation.

I also see FortiAuthProxy is new Fortinet product. First time I hear about. Thanks for the info.